juice-shop

1
/*
2
 * Copyright (c) 2014-2024 Bjoern Kimminich & the OWASP Juice Shop contributors.
3
 * SPDX-License-Identifier: MIT
4
 */
5

6
import frisby = require('frisby')
7
import config from 'config'
8

9
const URL = 'http://localhost:3000'
10

11
const jsonHeader = { 'content-type': 'application/json' }
12
let authHeader: { Cookie: any }
13

14
beforeAll(() => {
15
  return frisby.post(`${URL}/rest/user/login`, {
16
    headers: jsonHeader,
17
    body: {
18
      email: 'jim@juice-sh.op',
19
      password: 'ncc-1701'
20
    }
21
  })
22
    .expect('status', 200)
23
    .then(({ json }) => {
24
      authHeader = { Cookie: `token=${json.authentication.token}` }
25
    })
26
})
27

28
describe('/profile', () => {
29
  it('GET user profile is forbidden for unauthenticated user', () => {
30
    return frisby.get(`${URL}/profile`)
31
      .expect('status', 500)
32
      .expect('header', 'content-type', /text\/html/)
33
      .expect('bodyContains', `<h1>${config.get<string>('application.name')} (Express`)
34
      .expect('bodyContains', 'Error: Blocked illegal activity')
35
  })
36

37
  it('GET user profile of authenticated user', () => {
38
    return frisby.get(`${URL}/profile`, {
39
      headers: authHeader
40
    })
41
      .expect('status', 200)
42
      .expect('header', 'content-type', /text\/html/)
43
      .expect('bodyContains', 'id="email" type="email" name="email" value="jim@juice-sh.op"')
44
  })
45

46
  it('POST update username of authenticated user', () => {
47
    const form = frisby.formData()
48
    form.append('username', 'Localhorst')
49

50
    return frisby.post(`${URL}/profile`, {
51
      // @ts-expect-error FIXME form.getHeaders() is not found
52
      headers: { 'Content-Type': form.getHeaders()['content-type'], Cookie: authHeader.Cookie },
53
      body: form,
54
      redirect: 'manual'
55
    })
56
      .expect('status', 302)
57
  })
58

59
  xit('POST update username is forbidden for unauthenticated user', () => { // FIXME runs into "socket hang up"
60
    const form = frisby.formData()
61
    form.append('username', 'Localhorst')
62

63
    return frisby.post(`${URL}/profile`, {
64
      // @ts-expect-error FIXME form.getHeaders() is not found
65
      headers: { 'Content-Type': form.getHeaders()['content-type'] },
66
      body: form
67
    })
68
      .expect('status', 500)
69
      .expect('header', 'content-type', /text\/html/)
70
      .expect('bodyContains', `<h1>${config.get<string>('application.name')} (Express`)
71
      .expect('bodyContains', 'Error: Blocked illegal activity')
72
  })
73
})
74